Introduction
Internal Controls are to be an integral part of any organization's financial and business
policies and procedures. Internal controls consists of all the measures taken by the
organization for the purpose of; (1) protecting its resources against waste, fraud, and
inefficiency; (2) ensuring accuracy and reliability in accounting and operating data; (3)
securing compliance with the policies of the organization; and (4) evaluating the level of
performance in all organizational units of the organization. Internal controls are simply good
business practices.
Responsibility
Everyone within the University has some role in internal controls. The roles vary depending
upon the level of responsibility and the nature of involvement by the individual. The
University Board of Trustees, President and senior executives establish the presence of
integrity, ethics, competence and a positive control environment. The division heads and
their staff have oversight responsibility for internal controls within their divisions. Managers
and supervisory personnel are responsible for executing control policies and procedures at
the detail level within their specific units. Each individual within a unit is to be cognizant of
proper internal control procedures associated with their specific job responsibilities.
The Internal Audit and Advisory Services (IAAS) role is to examine the adequacy and
effectiveness of the University’s internal controls and make recommendations where control
improvements are needed. Since IAAS is to remain independent and objective, it does not
have the primary responsibility for establishing or maintaining internal controls. However,
the effectiveness of the internal controls are enhanced through the reviews performed and
recommendations made by IAAS.
Elements of Internal Control
Internal control systems operate at different levels of effectiveness. Determining whether a
particular internal control system is effective is a judgment resulting from an assessment of
whether the five components - Control Environment, Risk Assessment, Control Activities,
Information and Communication, and Monitoring - are present and functioning. Effective
controls provide reasonable assurance regarding the accomplishment of established
objectives.
Control Environment
The control environment, as established by the organization's administration, sets the tone
of an institution and influences the control consciousness of its people. Leaders of each
division, area or activity establish a local control environment. This is the foundation for all
other components of internal control, providing discipline and structure. Control
environment factors include:




Integrity and ethical values;
The commitment to competence;
Leadership philosophy and operating style;
The way management assigns authority and responsibility, and organizes and
develops its people;
Risk Assessment
The process of identifying and analyzing risk is an ongoing process and is a critical
component of an effective internal control system. Attention must be focused on risks at all
levels and necessary actions must be taken to manage. Risks can pertain to internal and
external factors. After risks have been identified they must be evaluated.
Managing change requires a constant assessment of risk and the impact on internal
controls. Economic, industry and regulatory environments change and entities' activities
evolve. Mechanisms are needed to identify and react to changing conditions.
Every entity faces a variety of risks from external and internal sources that must be
assessed. A precondition to risk assessment is establishment of objectives, linked at
different levels and internally consistent. Risk assessment is the identification and analysis
of relevant risks to achievement of the objectives, forming a basis for determining how the
risks should be managed. Because economics, regulatory and operating conditions will
continue to change, mechanisms are needed to identify and deal with the special risks
associated with change.
Objectives must be established before administrators can identify and take necessary steps
to manage risks. Operations objectives relate to effectiveness and efficiency of the
operations, including performance and financial goals and safeguarding resources against
loss. Financial reporting objectives pertain to the preparation of reliable published financial
statements, including prevention of fraudulent financial reporting. Compliance objectives
pertain to laws and regulations which establish minimum standards of behavior.
Control Activities
Control activities are the policies and procedures that help ensure management directives
are carried out. They help ensure that necessary actions are taken to address risks to
achievement of the entity's objectives. Control activities occur throughout the organization,
at all levels, and in all functions. They include a range of activities as diverse as approvals,
authorizations, verifications, reconciliations, reviews of operating performance, security of
assets and segregation of duties.
Control activities usually involve two elements: a policy establishing what should be done
and procedures to effect the policy. All policies must be implemented thoughtfully,
conscientiously and consistently.
Information and Communication
Pertinent information must be identified, captured and communicated in a form and time
frame that enables people to carry out their responsibilities. Effective communication must
occur in a broad sense, flowing down, across and up the organization. All personnel must
receive a clear message from top management that control responsibilities must be taken
seriously. They must understand their own role in the internal control system, as well as
how individual activities relate to the work of others. They must have a means of
communicating significant information upstream.
Monitoring
Internal control systems need to be monitored - a process that assesses the quality of the
system's performance over time. Ongoing monitoring occurs in the ordinary course of
operations, and includes regular management and supervisory activities, and other actions
personnel take in performing their duties that assess the quality of internal control system
performance.
The scope and frequency of separate evaluations depend primarily on an assessment of
risks and the effectiveness of ongoing monitoring procedures. Internal control deficiencies
should be reported upstream, with serious matters reported immediately to top
administration and governing boards.
Internal control systems change over time. The way controls are applied may evolve. Once
effective procedures can become less effective due to the arrival of new personnel, varying
effectiveness of training and supervision, time and resources constraints, or additional
pressures. Furthermore, circumstances for which the internal control system was originally
designed also may change. Because of changing conditions, management needs to
determine whether the internal control system continues to be relevant and able to address
new risks.
Components of the Control Activity
Internal controls rely on the principle of checks and balances in the workplace. The following
components focus on the control activity:
Personnel need to be competent and trustworthy, with clearly established lines of authority
and responsibility documented in written job descriptions and procedures manuals.
Organizational charts provide a visual presentation of lines of authority and periodic updates
of job descriptions ensures that employees are aware of the duties they are expected to
perform.
Authorization Procedures need to include a thorough review of supporting information to
verify the propriety and validity of transactions. Approval authority is to be commensurate
with the nature and significance of the transactions and in compliance with University policy.
Segregation of Duties reduces the likelihood of errors and irregularities. An individual is not
to have responsibility for more than one of the three transaction components: authorization,
custody, and record keeping. When the work of one employee is checked by another, and
when the responsibility for custody for assets is separate from the responsibility for
maintaining the records relating to those assets, there is appropriate segregation of duties.
This helps detect errors in a timely manner and deter improper activities; and at the same
time, it should be devised to prompt operational efficiency and allow for effective
communications.
Physical Restrictions are the most important type of protective measures for safeguarding
University assets, processes and data.
Documentation and Record Retention is to provide reasonable assurance that all information
and transactions of value are accurately recorded and retained. Records are to be
maintained and controlled in accordance with the established retention period and properly
disposed of in accordance with established procedures.
Monitoring Operations is essential to verify that controls are operating properly.
Reconciliations, confirmations, and exception reports can provide this type of information.
Internal Control Limitations
There is no such thing as a perfect control system. Staff size limitations may obstruct efforts
to properly segregate duties, which requires the implementation of compensating controls
to ensure that objectives are achieved. A limited inherent in any system is the element of
human error, misunderstandings, fatigue and stress. Employees are to be encouraged to
take earned vacation time in order to improve operations through cross-training while
enabling employees to overcome or avoid stress and fatigue.
The cost of implementing a specific control should not exceed the expected benefit of the
control. Sometimes there is no out-of-pocket cost to establish an adequate control. A
realignment of duty assignments may be all that is necessary to accomplish the objective.
In analyzing the pertinent costs and benefits, managers also need to consider the possible
ramifications for the University at large and attempt to identify and weigh the intangible as
well as the tangible consequences.
Internal controls should reduce the risks associated with undetected errors or irregularities,
but designing and establishing effective internal controls is not always a simple task and
cannot always be accomplished through a short set of quick fixes. However, we hope this
material has helped to explain the basic internal control concepts and given you some ideas
for improving your department's controls.